Progress 3.1 Webspeed _CPYFile.P Unauthorized Access Vulnerability

2007-04-24T00:00:00
ID EDB-ID:29897
Type exploitdb
Reporter suresync
Modified 2007-04-24T00:00:00

Description

Progress 3.1 Webspeed _CPYFile.P Unauthorized Access Vulnerability. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/23634/info

Progress WebSpeed is prone to a vulnerability that lets attackers gain unauthorized access to and execute administrative scripts.

An attacker may leverage this issue to create and execute malicious WebSpeed code on the host running the webserver. Such unauthorized access may help the attacker launch other attacks.

WebSpeed 3.1a, 3.1d, and 3.1e are vulnerable; other versions may also be affected.

NOTE: Further reports suggest that this issue affects only the 'Development Mode' of the application. This mode is not intended to be used in production systems. This issue is also present when the 'tty' directory is installed. 

http://www.example.com/scripts/cgiip.exe/WService=wsbroker1/webutil/_cpyfile.p?options=save,editor&tempFile=dummy.tmp&fil
eName=C:/root.txt&action=last&section=1&txt0=Test